Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-93wv-jw9v-4972
  • Maven/io.netty:netty-codec-http2
 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) 31 Jul
  • Fix available
  • Severity - 7.5 (High)
GHSA-c69g-56f8-xwqj
  • Maven/io.netty:netty-codec-http2
 Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass 22 Jul
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-563q-j3cm-6jxm
  • Maven/io.netty:netty-codec-http2
 Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature 15 Jun
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-c2gf-v879-257j
  • Maven/io.netty:netty-codec-http2
 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion 11 Jun
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-5x3r-wrvg-rp6q
  • Maven/io.netty:netty-codec-http2
 Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced 08 Jun
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-f6hv-jmp6-3vwv
  • Maven/io.netty:netty-codec-http
  • Maven/io.netty:netty-codec-http2
 Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS 07 May
  • Fix available
  • Severity - 7.5 (High)
GHSA-w9fj-cfpg-grvv
  • Maven/io.netty:netty-codec-http2
 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass 26 Mar
  • Fix available
  • Severity - 8.7 (High)
GHSA-prj3-ccx8-p6x4
  • Maven/io.grpc:grpc-netty-shaded
  • Maven/io.netty:netty-codec-http2
 Netty affected by MadeYouReset HTTP/2 DDoS vulnerability 13 Aug 2025
  • Fix available
  • Severity - 8.2 (High)
GHSA-xpw8-rcwv-8f8p
  • Maven/io.netty:netty-codec-http2
 io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack 10 Oct 2023
  • Fix available
  • Severity - 7.5 (High)
GHSA-f256-j965-7f32
  • Maven/io.netty:netty
  • Maven/io.netty:netty-codec-http2
  • Maven/org.jboss.netty:netty
 Possible request smuggling in HTTP/2 due missing validation of content-length 30 Mar 2021
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-wm47-8v5p-wjpj
  • Maven/io.netty:netty
  • Maven/io.netty:netty-codec-http2
  • Maven/org.jboss.netty:netty
 Possible request smuggling in HTTP/2 due missing validation 09 Mar 2021
  • Fix available
  • Severity - 5.9 (Medium)